Include the Origin header for XHR and Fetch API even if the request is same-origin

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

Index: third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
index 593c806a974ebfc1e1b984e4e34c984f7b91679b..94987bc883057db2bd02e0edbadfa04e64a65f4a 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
@@ -249,6 +249,10 @@ void DocumentThreadableLoader::start(const ResourceRequest& request)
             // handled a request.
             m_fallbackRequestForServiceWorker.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::Controlling);
         }
+
+        if (m_options.sameOriginHeaderPolicy == IncludeSameOriginHeader)
+            newRequest.setHTTPOrigin(getSecurityOrigin());
+
         loadRequest(newRequest, m_resourceLoaderOptions);
         return;
     }
@@ -256,9 +260,12 @@ void DocumentThreadableLoader::start(const ResourceRequest& request)
     dispatchInitialRequest(newRequest);
 }
 
-void DocumentThreadableLoader::dispatchInitialRequest(const ResourceRequest& request)
+void DocumentThreadableLoader::dispatchInitialRequest(ResourceRequest& request)
 {
     if (!request.isExternalRequest() && (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests)) {
+        if (m_options.sameOriginHeaderPolicy == IncludeSameOriginHeader)
+            request.setHTTPOrigin(getSecurityOrigin());
+
         loadRequest(request, m_resourceLoaderOptions);
         return;
     }
@@ -313,7 +320,7 @@ void DocumentThreadableLoader::makeCrossOriginAccessRequest(const ResourceReques
     } else {
         m_crossOriginNonSimpleRequest = true;
         // Do not set the Origin header for preflight requests.
-        updateRequestForAccessControl(crossOriginRequest, 0, effectiveAllowCredentials());
+        updateRequestForAccessControl(crossOriginRequest, nullptr, effectiveAllowCredentials());
         // We update the credentials mode according to effectiveAllowCredentials() here for backward compatibility. But this is not correct.
         // FIXME: We should set it in the caller of DocumentThreadableLoader.
         crossOriginRequest.setFetchCredentialsMode(effectiveAllowCredentials() == AllowStoredCredentials ? WebURLRequest::FetchCredentialsModeInclude : WebURLRequest::FetchCredentialsModeOmit);